Windows Defender Antivirus Exclusions

As every Antivirus solution also MS had some exclusions for files not being scanned. This is mainly for performance but also for operational reasons. E.g. you have a VHD file from a VM. The VM Guest itself is already scanning itself. So no need for the host to scan an VHD file. But there a still others. Here you get a comprehensive updated list for exclusions from field MS support engineers.

Especially SCCM, SQL and IIS workloads need additional exclusions for operational reasons!

The recommendations for each section are separated between "Operational" and "Performance" levels.  Operational recommendations are highly encouraged to be added to your exclusions list.  Performance recommendations should only be considered if you are experiencing such issues that may be a result of your antivirus product.
The following information will cover what could be recommended for your environment.
Details on the variables referenced:

1. <InstallDrive> can be multiple drives in some environments, so it is best to use a wildcard if possible for the antivirus solution you have deployed throughout your environment.  Please refer to your vendor’s documentation for further instructions.
2.  <InstanceName> is the name of the SQL instance you are using in your environment.  Please be aware if you use any named SQL instances or the default, "MSSQLServer".
3.  <SQL Version> is the version of SQL you are using in your environment.  This may also differ between each SQL service referenced between versions SQL Server 2005-2008 R2 and SQL Server 2012+.  Please be aware of what version you have installed.  309422 and the article below can provide you with more details.

How to determine the version, edition and update level of SQL Server and its components
Core Exclusions for Supported Versions of Windows

• Operational
  • %allusersprofile%\NTUser.pol
  • %windir%\Security\Database\*.chk
  • %windir%\Security\Database\*.cmtx
  • %windir%\Security\Database\*.csv
  • %windir%\Security\Database\*.edb
  • %windir%\Security\Database\*.jrs
  • %windir%\Security\Database\*.log
  • %windir%\Security\Database\*.sdb
  • %windir%\Security\Database\*.xml
  • %windir%\SoftwareDistribution\Datastore\Datastore.edb
  • %windir%\SoftwareDistribution\Datastore\Logs\edb.chk
  • %windir%\SoftwareDistribution\Datastore\Logs\edb*.jrs
  • %windir%\SoftwareDistribution\Datastore\Logs\edb*.log
  • %windir%\SoftwareDistribution\Datastore\Logs\tmp.edb
  • %windir%\System32\GroupPolicy\Machine\Registry.pol
  • %windir%\System32\GroupPolicy\User\Registry.pol

Reference: 822158
ConfigMgr Core Installation Exclusions (All Versions)

• Operational
  • <InstallDrive>\Program Files\Microsoft Configuration Manager\Inboxes\*.*
  • <InstallDrive>\Program Files\Microsoft Configuration Manager\Install.map
  • <InstallDrive>\Program Files\Microsoft Configuration Manager\Logs
  • <InstallDrive>\Program Files\SMS_CCM\Logs
  • <InstallDrive>\Program Files\SMS_CCM\ServiceData

References: 327453, SCCM 2012 Antivirus Exclusions
ConfigMgr Core Installation Exclusions (Current Branch Versions)

• Applicable to 1511+
  • Operational
    • <InstallDrive>\Program Files\Microsoft Configuration Manager\cd.latest
    • <InstallDrive>\Program Files\Microsoft Configuration Manager\EasySetupPayload
  • Performance
    • <InstallDrive>\Program Files\Microsoft Configuration Manager\AdminUIContentPayload
    • <InstallDrive>\Program Files\Microsoft Configuration Manager\AdminUIContentStaging
    • <InstallDrive>\Program Files\Microsoft Configuration Manager\CMUStaging
• Applicable to 1602+
  • Performance
    • <InstallDrive>\Program Files\Microsoft Configuration Manager\CMUClient
• Applicable to 1610+
  • Performance
    • <InstallDrive>\Program Files\Microsoft Configuration Manager\PilotingUpgrade
    • <InstallDrive>\Program Files\Microsoft Configuration Manager\RLAStaging
• Applicable to 1702+
  • Performance
    • <InstallDrive>\Program Files\Microsoft Configuration Manager\CMProviderLog

Reference: 327453
ConfigMgr Content Library Exclusions

• Operational
  • <InstallDrive>\SMS_DP$
  • <InstallDrive>\SMSPKG<DriveLetter>$
  • <InstallDrive>\SMSPKG
  • <InstallDrive>\SMSPKGC$
  • <InstallDrive>\SMSPKGSIG
  • <InstallDrive>\SMSSIG$
• Performance
  • <InstallDrive>\SCCMContentLib
  • <InstallDrive>\<ConfigMgr Backup Directory>
    • Ex. D:\SCCMBackup
  • <InstallDrive>\<ConfigMgr Package Source Files>
    • Ex. D:\SCCMSource

Reference: 327453
ConfigMgr Imaging Exclusions

• Operational
  • <InstallDrive>\ConfigMgr_OfflineImageServicing
  • %windir%\TEMP\BootImages
• Performance
  • %SystemDrive%\_SMSTaskSequence

Reference: SCCM 2012 Antivirus Exclusions
ConfigMgr Process Exclusions
NOTE***Process Exclusions are necessary only when aggressive antivirus programs consider System Center Configuration Manager executables (.exe) to be high risk processes.

• Operational
  • Client Side
    • %windir%\CCM\Ccmexec.exe
    • %windir%\CCM\CmRcService.exe
    •  %windir%\CCM\Ccmrepair.exe
    • %windir%\CCM\Ccmsetup.exe
  • Server Side
    • %windir%\CCM\Ccmexec.exe
    • %windir%\SMS_CCM\Ccmexec.exe
    • <InstallDrive>\Program Files\Microsoft Configuration Manager\bin\x64\Cmupdate.exe
    • <InstallDrive>\Program Files\Microsoft Configuration Manager\bin\x64\Sitecomp.exe
    • <InstallDrive>\Program Files\Microsoft Configuration Manager\bin\x64\Smsexec.exe
    • <InstallDrive>\Program Files\Microsoft Configuration Manager\bin\x64\Smssqlbbkup.exe
    • <InstallDrive>\Program Files\Microsoft Configuration Manager\bin\x64\Smswriter.exe
    • <InstallDrive>\SMS_<SQLFQDN>\bin\x64\Smssqlbbkup.exe

Reference: 327453
ConfigMgr Client Exclusions

• Operational
  • %windir%\CCM\*.sdf
  • %windir%\CCM\Logs
  • %windir%\CCM\ServiceData
  • %windir%\CCMCache
  • %windir%\CCMSetup

Reference: 327453
SQL Server Exclusions

• Operational
  • SQL Server Process Exclusions
    • SQLServr.exe
      • <InstallDrive>\Program Files\Microsoft SQL Server\<SQL Version>. <InstanceName>\MSSQL\Binn\SQLServr.exe
    • ReportingServicesService.exe
      • <InstallDrive>\Program Files\Microsoft SQL Server\<SQL Version>.<InstanceName>\Reporting Services\ReportServer\Bin\ReportingServicesService.exe
    • MSMDSrv.exe
      • <InstallDrive>\Program Files\Microsoft SQL Server\<SQL Version>.<InstanceName>\OLAP\Bin\MSMDSrv.exe
  • SQL Server data files
    • *.mdf
    • *.ldf
    • *.ndf
  • SQL Server backup files
    • *.bak
    • *.trn
  • SQL Audit files
    • *.sqlaudit
  • SQL Query files
    • *.sql
  • SQL Trace Files
    • *.trc
  • Analysis Services data files
    • <InstallDrive>\Program Files\Microsoft SQL Server\<SQL Version>.<InstanceName>\OLAP\Backup
    • <InstallDrive>\Program Files\Microsoft SQL Server\<SQL Version>.<InstanceName>\OLAP\Data
    • <InstallDrive>\Program Files\Microsoft SQL Server\<SQL Version>.<InstanceName>\OLAP\Log
  • Full-Text catalog files
    • <InstallDrive>\Program Files\Microsoft SQL Server\<SQL Version>.<InstanceName>\MSSQL\FTData
  • Reporting Services Files
    • <InstallDrive>\Program Files\Microsoft SQL Server\<SQL Version>.<InstanceName>\Reporting Services\LogFiles
    • <InstallDrive>\Program Files\Microsoft SQL Server\<SQL Version>.<InstanceName>\Reporting Services\RSTempFiles
  • Replication Files
    • <InstallDrive>\Program Files (x86)\Microsoft SQL Server\<SQL Version>\COM
    • <InstallDrive>\Program Files\Microsoft SQL Server\<SQL Version>\COM
  • Replication Snapshot Files
    • <InstallDrive>\Program Files\Microsoft SQL Server\<SQL Version>.<InstanceName>\MSSQL\ReplData
    • These files typically have file name extensions of the following:
      • *.sch
      • *.idx
      • *.bcp
      • *.pre
      • *.cft
      • *.dri
      • *.trg
      • *.prc
  • Checkpoint and delta files
    • No specific file extension for the files
    • Files are present under the folder structure identified by the container of type FILE_STREAM from sys.database_files
  • DBCC CHECKDB Files
    • Files will be of the format <Database_data_filename.extension>_MSSQL_DBCC<database_id_of_snapshot>
    • For more information, see the following article:
      • 2974455 DBCC CHECKDB behavior when the SQL Server database is located on an ReFS volume
  • Exception Dump Files
    • *.mdmp
  • Extended Event Files
    • *.xel
    • *.xem
  • Filestream data files
    • SQL 2008 and later versions
  • In-memory OLTP Files
    • Present in a xtp sub-folder under the DATA directory for the instance
    • File formats include the following:
      • xtp_<t/p>_<dbid>_<objid>.c
      • xtp_<t/p>_<dbid>_<objid>.dll
      • xtp_<t/p>_<dbid>_<objid>.obj
      • xtp_<t/p>_<dbid>_<objid>.out
      • xtp_<t/p>_<dbid>_<objid>.pdb
      • xtp_<t/p>_<dbid>_<objid>.xml
  • Remote Blob Storage files
    • SQL 2008 and later versions
  • Windows Failover Clustering (If applicable)
    • <Quorum Drive> (Ex. Q:\)
    • %windir%\Cluster
    • MSDTC directory in the MSDTC drive

References: 309422, 250355, 2974455 
IIS Exclusions

• Operational
  • IIS Compressed Files
    • IIS 6.0:
      • %SystemRoot%\IIS Temporary Compressed Files
    • IIS 7.0+:
      • %SystemDrive%\inetpub\temp\IIS Temporary Compressed Files
  • IIS Worker Process
    • %windir%\System32\inetsrv\w3wp.exe
    • %windir%\SysWOW64\inetsrv\w3wp.exe

Reference: 817442
WSUS Exclusions

• Operational
  • %SystemRoot%\SoftwareDistribution\Datastore
  • %SystemRoot%\SoftwareDistribution\Download
  • %ProgramFiles%\Update Services\LogFiles\WSUSTemp
  • <InstallDrive>\WSUS\UpdateServiceDBFiles
  • <InstallDrive>\WSUS\WSUSContent

For more informations also refer to the original blog post here: https://blogs.technet.microsoft.com/systemcenterpfe/2017/05/24/configuration-manager-current-branch-antivirus-update/

Microsoft Defender - out of the darkness into the light

Often customers ask me for advice in regards of Antivirus. The next I explain in general is the difference between user-mode and kernel-mode. To make a long story short. Antivirus solutions use in general kernel-mode filter drivers. When you do there a mistake then you will see a bluescreen. Internal studies for reasons of bluescreens reveal 70% bugs in filter drivers from 3rd parties.

There are some AV vendors out there with a very poor code quality in filter drivers. I will not blame here specific vendors. The users of these vendors often raise complaints to me about them. Unfortunately these vendors have extra ordinary enterprise management capabilities. So you see pros and cons.

On the other side I hear often the "old" stories about Microsoft Windows Defender in terms of AV scanning results. Its absolutely true that these results were in the past - before June 2015 - very bad (specifically the tests from independent AV-test.org (how independent they are in reality I can neither proof nor deny!)). 

MS did a complete rewrite of the code and structure they are using. Combining with new technologies like block on first sight, machine learning and many more. This brought up a very good AV solution right now.

In the past I used for example AVIRA for my personal computer. But now I can state there is no other paid AV solution necessary for me. I started also in trusting Microsoft Windows Defender and its companion SystemCenter Endpoint Protection (actually the same engine. Only the management plugin makes the defender enterprise ready.)

To get the full story also checkout this blog entry from Brad Anderson.
https://cloudblogs.microsoft.com/microsoftsecure/2018/03/22/why-windows-defender-antivirus-is-the-most-deployed-in-the-enterprise/

Windows Defender Application Guard (updated)

With the new release of Windows 10 - 1709 there is a great new feature out called "Windows Defender - Application Guard"

The idea is to limit the access to the system by isolating the browser experience and lock in hackers potentially using the browser to enter the system.

 

This feature let your Edge browser run in a VM for unknown websites. You will not experience a VM startup. It just feels like a "different private mode" in your browser.

A good idea - how it works behind the scenes - can be found in this video:

 

End-users know the difference by a visual representation.

You can manage it through GPOs telling which trusted websites (e.g. organizational websites) should be open in Edge normally also using the full set of Win32 APIs.

All other websites would be opened in the sandboxed version of Edge. The sandboxing is realized also by Hyper-V virtualization. It includes a kernel with a limited set of Win32 APIs to make it even harder to break in. But even if it is possible to break in the attacker is locked in the virtualization layer. When you close the browser the threat is also gone. As this is a non persistent environment.

Additionally this is tied into Windows Defender Advanced Threat Protection. So you get even notified if someone tried to compromise your environment.

To get more information's on this checkout this site.
https://blogs.windows.com/msedgedev/2016/09/27/application-guard-microsoft-edge


And to get the FULL CURRENT (1709) holistic Microsoft Security view. Please checkout this recent video. Which covers more than just Application Guard which is one brick in a bigger wall.

 

To enable it is relatively simple (depending HW reqs.)

 

But you need to fulfill the requirements:

 

• Windows 10 Enterprise SKU only
• PC must support Hyper-V (some older PCs may not support Hyper-V or have this feature disabled in BIOS)
• Windows Defender Application Guard is Off by default, it must be enabled manually or by policy
• Hardware Limits:
• Min. 4 (!) logical processors (E.g. Dual Core + Hyperthreading etc.)
• Min. 8 GB RAM
• Min. 5 GB HDD Disk
• When you follow these limits and you enable GuestVirtualization in the Hyper-V (only possible via Powershell) then it works also in a VM.

Otherwise the feature is greyed out!

 

Currently WDAG reacts a bit tricky with Updates. So it worked in 16299.19 in English-US version of Windows. Update KB4043961 broke the feature so you need to dismiss this update. Also other languages may not work right away. But in later version onwards 17035 is also starts to working in German again.

 

1. You need to enable Windows Application Guard in the "Windows Features"

 

 

2. You need to setup the Policies for WDAG (very important!)

• Network Isolation Policies (defining whats enterprise network)

  Computer Configuration\Administrative Templates\Network\Network Isolation
• Application Guard Policies (defining WDAG behaviour)

  Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard

More about the policies you find here:

https://docs.microsoft.com/de-de/windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard